1. Technical Field
The invention generally relates to protecting the data a user enters on the internet. More particularly the invention relates to protecting data entered on the internet and preventing it being sent to unexpected locations, a technique known as “phishing.”
2. Background Art
“Phishing” refers to the process of tricking or socially engineering an organisation's customers into imparting their confidential electronic identity for nefarious use. Phishing is a serious threat to any online business and service because it leads to unauthorised information access, fraud, and financial loss.
The person performing such an act is generally referred to as a “phisher.” In general, the phisher will impersonate a trusted source so that the victim will be led to affirmatively perform a series of actions that will provide access to confidential information.
Common phishing techniques include tricking users into keying in fraudulent web addresses, or clicking on web links embedded in a fraudulent email, or manipulating DNS (domain name service) information. The aforementioned techniques will eventually cause web browsers to display fraudulent web content set up by the phishers. The fraudulent web content could take the form of a look-alike web page to a genuine web page, or fraudulent data input fields embedded into a genuine web page, or a pop-up window appearing on top of the original website.
The ultimate objective is to lead the users into believing that the data entry fields presented are genuine and hence into submitting confidential information to the phishers. Regardless of the technique deployed, the fraudulent web content will always contain data input fields for the web users to fill in and submit. The submitted data is typically confidential information such as login names and passwords, which will allow the phishers to exploit the electronic identities of their victims.
Known anti-phishing methods are either ineffective against the ever innovative phishing techniques or simply too costly for large scale deployment. Anti-phishing methods based on website bookmarks are ineffective against fraudulent web links on fake emails, or a fraudulent login page embedded into a genuine web page using a cross-site scripting method. Anti-phishing methods based on blacklists are unable to cope with the rapidly increasing fraudulent websites. Hardware token-based authentication methods are very costly for mass distribution.
The present invention provides a solution to this and other problems that offers advantages over the prior art.